---
id: CVE-2026-93451
title: >-
  snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed
  Snappy.uncompress*Array methods that allocate output arrays by dividing
  uncompressed length by element size but pass the undivided length to native
  code
summary: >-
  snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed
  Snappy.uncompress*Array methods that allocate output arrays by dividing
  uncompressed length by element size but pass the undivided length to native
  code. Atta…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-787
vendor: xerial
product: snappy-java
affected:
  - snappy-java <= 1.1.10.8
published: '2026-09-18'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:25:55.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93451'
references:
  - url: 'https://github.com/xerial/snappy-java'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802
    label: disclosure@vulncheck.com
  - url: 'https://github.com/xerial/snappy-java/issues/729'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00296
epssPercentile: 0.2245
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-21T16:28:43.993959Z'
ingestedAt: '2026-09-17T23:31:20.694Z'
---

## Overview

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.